[aw-doctor:compiler-security] Compiler/security scan findings: grant license policy failure, actionlint errors, container CVEs (githubnext/gh-aw-cao)

The gh-aw compiler run against `githubnext/gh-aw-cao` (51 workflow sources, 51 generated locks) exited with code 1 due to `grant` failing its strict license-policy gate (1250 findings). Beyond that hard failure, the run also surfaced 2 actionlint expression errors, 49 zizmor High findings, 447 zizmor Medium findings (mostly `secrets-outside-env` and `artipacked`), 1 runner-guard Medium finding, and container-image vulnerability scans showing 34 Critical / 130 High / 306 Medium CVEs across 9 scanned images (openssl/curl/glibc/libssl family CVEs concentrated in the `gh-aw-firewall`, `gh-aw-mcpg`, `github-mcp-server`, and base `alpine`/`node` images).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `51`
- **Generated lock files checked**: `51`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | `self-care-dashboard-performance.lock.yml`, `self-care-pages-health.lock.yml` | error | `safe-outputs-app-token` step referenced in a `GIT_TOKEN`/env expression is not defined in the enclosing job's step-outputs type (compiler-generated job template bug) | Recompile after any source fix; if the mismatch persists across a fresh `gh aw compile`, treat as a gh-aw compiler defect and report upstream — do not hand-edit the `.lock.yml` |
| grant (license scanner) | 9 container images (`gh-aw-firewall/agent`, `api-proxy`, `cli-proxy`, `squid`, `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, `alpine`, `node:lts-alpine`) | error (strict mode) | 1250 license-policy violations, predominantly GPL/LGPL/copyleft-tagged system packages (e.g. `apt`, `git-man`, `libglib2.0-0`, `libgnutls30`, `dash`) bundled in base OS layers | This is the finding causing the non-zero exit. Either upgrade/slim the referenced base images to reduce bundled copyleft packages, or review and intentionally adjust the `grant` allow-list/policy for base-OS system packages that are not redistributed; do not silently suppress without review |
| zizmor | 41 lock files | High (49×) | `github-app`: dangerous use of `actions/create-github-app-token` — flagged pattern is inherent to the CAO app-token minting design | Confirm scoping/expiry is already minimal; if so, this is an accepted-risk pattern — otherwise narrow token permissions requested at mint time |
| zizmor | many lock files | Medium (418×) | `secrets-outside-env`: secrets referenced without a dedicated `environment:` | Consider moving secret-consuming steps into a scoped `environment:` block where feasible |
| zizmor | multiple lock files (e.g. `dashboard-authoring-corpus`, `dependabot-release-train-updater`) | Medium (29×) | `artipacked`: checkout steps may persist credentials into artifacts | Add `persist-credentials: false` to `actions/checkout` steps that don't need to push, or ensure artifact upload excludes `.git` |
| runner-guard | `agentic_commands.yml` | Medium | RGS-005: job carries write permissions while triggered by a command/comment-style event (`issue_comment`/`pull_request_review_comment`) | Verify the trusted-command guard (`min-integrity: approved`) fully gates the write permissions before any untrusted input reaches privileged steps |
| grype | `gh-aw-firewall/*`, `gh-aw-mcpg`, `github-mcp-server`, `alpine`, `node:lts-alpine` | Critical (34) / High (130) / Medium (306) | CVEs concentrated in `openssl`/`libssl3`/`libcrypto3` (e.g. CVE-2026-75803, CVE-2026-63073), `curl`/`libcurl` (CVE-2026-18924, CVE-2026-19931, CVE-2026-80229/80230/80231), `glibc` (CVE-2026-5450), and npm-bundled `brace-expansion`/`tar`/`ip-address` (GHSA-mh99-v99m-4gvg, GHSA-r292-9mhp-454m, GHSA-mwp4-54f8-5fhr, GHSA-rgw5-rvv9-x895) | Bump pinned image tags/digests for `gh-aw-firewall` (agent/api-proxy/cli-proxy/squid), `gh-aw-mcpg`, `gh-aw-node`, `github-mcp-server`, and the `alpine`/`node:lts-alpine` base layers to versions carrying patched packages |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Aggregate counts from the deterministic compiler/scanner run:

- Actionlint: 51 workflows checked, 2 issues (2 errors, both `expression` category)
- Zizmor: severities across scan — Critical 34 (container CVEs, not zizmor rules), zizmor rule findings: `secrets-outside-env` ×418 (Medium), `github-app` ×49 (High), `artipacked` ×29 (Medium); plus 311 Informational / 323 Low lower-priority style findings not itemized here
- Poutine / runner-guard: 1 Medium finding (`RGS-005` in `agentic_commands.yml`)
- Syft: SBOMs generated for 9 container images (567–16 packages each)
- Grype: 34 Critical, 130 High, 306 Medium CVEs across the 9 scanned images
- Grant (license scanner): 1250 policy violations across 9 images — this is the finding that produced the overall `grant failed (strict mode)` exit and non-zero compiler exit code
- Yamllint / shellcheck: no blocking errors; shellcheck reported only informational `SC2034` (unused variable) warnings in `graders/*-operational-value.sh` scripts

No secret or credential values were present in the tool output requiring redaction.

Control plane context

- Correlation ID: `34552721126-1056`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34552721126`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34552721126) · copilot · auto · 50.2 AIC · ⌖ 8.95 AIC · ⊞ 12.4K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 25, 2026, 2:17 AM UTC

Start in the target repository by reviewing the findings for .github/workflows/*.md, especially agentic_commands.yml, and run gh aw compile with the required security scanners. Do not edit generated .lock.yml files. Done means the compiler, actionlint, zizmor, runner-guard, grant, grype, syft, shellcheck, and yamllint checks pass, or any unsafe finding is documented for human review.

Written by the indexing model from the issue text.